last executing test programs: 99.031094ms ago: executing program 2 (id=3): unshare(0x20000) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$tmpfs(0x0, 0x0, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0/file1\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0/file1/file2\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file0/file1/file2/file3\x00', 0x1c0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0/file1/file2/file3/file4\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f0000000200)='./file0/file1/file2/file3/file5\x00', 0x81c0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0/file6\x00', 0x1c0) mount$bind(&(0x7f0000000300)='./file0/file1\x00', &(0x7f0000000340)='./file0/file6\x00', 0x0, 0x5000, 0x0) r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000380)='./file0/file6/file2\x00', 0x0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000003c0)='./file0/file1/file2\x00', 0xffffffffffffff9c, &(0x7f0000000400)='./file0/file2\x00', 0x0) r1 = landlock_create_ruleset(&(0x7f0000000440)={0x2004}, 0x18, 0x0) landlock_restrict_self(r1, 0x0) renameat2(r0, &(0x7f0000000540)='file3/file5\x00', r0, &(0x7f0000000580)='file3/file4/file5\x00', 0x0) 85.075005ms ago: executing program 0 (id=1): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000040)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x6a855000) syz_clone(0x1000000, 0x0, 0xfffffd11, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) prctl$PR_SET_THP_DISABLE(0x29, 0x1) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 65.129807ms ago: executing program 1 (id=2): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000140), 0x80482, 0x0) write$vga_arbiter(r0, &(0x7f0000000240)=ANY=[@ANYBLOB='decodes none'], 0xd) 0s ago: executing program 3 (id=4): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f000000040b2100000095f5758483"], 0x0}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.237' (ED25519) to the list of known hosts. [ 26.078890][ T282] cgroup: Unknown subsys name 'net' [ 26.084498][ T36] audit: type=1400 audit(1770082061.210:64): avc: denied { mounton } for pid=282 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2022 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 26.109006][ T36] audit: type=1400 audit(1770082061.210:65): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.109468][ T282] cgroup: Unknown subsys name 'devices' [ 26.131872][ T36] audit: type=1400 audit(1770082061.210:66): avc: denied { unmount } for pid=282 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 26.238315][ T282] cgroup: Unknown subsys name 'hugetlb' [ 26.244039][ T282] cgroup: Unknown subsys name 'rlimit' [ 26.336415][ T36] audit: type=1400 audit(1770082061.470:67): avc: denied { setattr } for pid=282 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 26.360241][ T36] audit: type=1400 audit(1770082061.470:68): avc: denied { mounton } for pid=282 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 26.387288][ T36] audit: type=1400 audit(1770082061.470:69): avc: denied { mount } for pid=282 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 26.396986][ T284] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). Setting up swapspace version 1, size = 127995904 bytes [ 26.419702][ T36] audit: type=1400 audit(1770082061.550:70): avc: denied { relabelto } for pid=284 comm="mkswap" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.445708][ T36] audit: type=1400 audit(1770082061.550:71): avc: denied { write } for pid=284 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.483297][ T36] audit: type=1400 audit(1770082061.610:72): avc: denied { read } for pid=282 comm="syz-executor" name="swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.509583][ T36] audit: type=1400 audit(1770082061.610:73): avc: denied { open } for pid=282 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2025 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 26.509826][ T282] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 27.322863][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.330001][ T289] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.337277][ T289] bridge_slave_0: entered allmulticast mode [ 27.343527][ T289] bridge_slave_0: entered promiscuous mode [ 27.351476][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.358668][ T289] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.365793][ T289] bridge_slave_1: entered allmulticast mode [ 27.372423][ T289] bridge_slave_1: entered promiscuous mode [ 27.460912][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.468809][ T291] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.476231][ T291] bridge_slave_0: entered allmulticast mode [ 27.482611][ T291] bridge_slave_0: entered promiscuous mode [ 27.489476][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.496664][ T291] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.503906][ T291] bridge_slave_1: entered allmulticast mode [ 27.510333][ T291] bridge_slave_1: entered promiscuous mode [ 27.577255][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.584505][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.591999][ T295] bridge_slave_0: entered allmulticast mode [ 27.598418][ T295] bridge_slave_0: entered promiscuous mode [ 27.606424][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.613556][ T293] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.620643][ T293] bridge_slave_0: entered allmulticast mode [ 27.627088][ T293] bridge_slave_0: entered promiscuous mode [ 27.633744][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.641299][ T293] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.648639][ T293] bridge_slave_1: entered allmulticast mode [ 27.655005][ T293] bridge_slave_1: entered promiscuous mode [ 27.661154][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.668417][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.675709][ T295] bridge_slave_1: entered allmulticast mode [ 27.681899][ T295] bridge_slave_1: entered promiscuous mode [ 27.780306][ T289] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.788414][ T289] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.796680][ T289] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.803982][ T289] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.863845][ T291] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.870972][ T291] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.878478][ T291] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.885714][ T291] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.899978][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.907146][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.914522][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.921678][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.934266][ T293] bridge0: port 2(bridge_slave_1) entered blocking state [ 27.942093][ T293] bridge0: port 2(bridge_slave_1) entered forwarding state [ 27.949867][ T293] bridge0: port 1(bridge_slave_0) entered blocking state [ 27.957580][ T293] bridge0: port 1(bridge_slave_0) entered forwarding state [ 27.983909][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 27.991574][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 27.999489][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.007177][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.014851][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.022157][ T13] bridge0: port 1(bridge_slave_0) entered disabled state [ 28.029861][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.037333][ T13] bridge0: port 2(bridge_slave_1) entered disabled state [ 28.064562][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.071656][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.100303][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.107505][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.115179][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.122429][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.131304][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.138469][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.148582][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.155757][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.179074][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 28.186220][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 28.194148][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.201280][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.214245][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 28.221344][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 28.265458][ T293] veth0_vlan: entered promiscuous mode [ 28.273112][ T291] veth0_vlan: entered promiscuous mode [ 28.283056][ T289] veth0_vlan: entered promiscuous mode [ 28.305291][ T293] veth1_macvtap: entered promiscuous mode [ 28.314519][ T291] veth1_macvtap: entered promiscuous mode [ 28.324668][ T289] veth1_macvtap: entered promiscuous mode [ 28.361112][ T295] veth0_vlan: entered promiscuous mode [ 28.374361][ T291] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 28.402405][ T295] veth1_macvtap: entered promiscuous mode [ 28.498815][ T339] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 28.589367][ T335] ------------[ cut here ]------------ [ 28.595081][ T335] WARNING: CPU: 0 PID: 335 at security/landlock/fs.c:1025 collect_domain_accesses+0x327/0x390 [ 28.605579][ T335] Modules linked in: [ 28.609786][ T335] CPU: 0 UID: 0 PID: 335 Comm: syz.2.3 Not tainted syzkaller #0 d2070f6ccd239e5a47ec9c1c2f682235c3170fcc [ 28.621735][ T335] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 28.632002][ T335] RIP: 0010:collect_domain_accesses+0x327/0x390 [ 28.638462][ T335] Code: 7f 14 73 ff eb 08 e8 a8 6a 0a ff 41 b4 01 44 89 e0 48 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 89 6a 0a ff <0f> 0b 45 31 e4 eb cb e8 7d 6a 0a ff 0f 0b eb d1 89 d9 80 e1 07 80 [ 28.659342][ T335] RSP: 0018:ffffc9000b8e7af0 EFLAGS: 00010287 [ 28.665975][ T335] RAX: ffffffff827d3287 RBX: ffff888121a9e880 RCX: 0000000000080000 [ 28.674699][ T335] RDX: ffffc900029f6000 RSI: 00000000000001f8 RDI: 00000000000001f9 [ 28.683236][ T335] RBP: ffffc9000b8e7b30 R08: ffff88810b3f1300 R09: 0000000000000002 [ 28.691465][ T335] R10: 0000000000000002 R11: 0000000000000002 R12: 0000000000000000 [ 28.699759][ T335] R13: 0000000000002004 R14: 1ffffffff0e40096 R15: dffffc0000000000 [ 28.707915][ T335] FS: 00007f8d892786c0(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 [ 28.717110][ T335] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 28.724006][ T335] CR2: 00007f33be1840c0 CR3: 000000010e340000 CR4: 00000000003526b0 [ 28.733140][ T335] Call Trace: [ 28.736890][ T335] [ 28.740587][ T335] current_check_refer_path+0x8ee/0xd40 [ 28.747400][ T335] ? hook_file_free_security+0xc0/0xc0 [ 28.754611][ T335] hook_path_rename+0x44/0x60 [ 28.762973][ T335] security_path_rename+0x1d8/0x2a0 [ 28.769822][ T335] do_renameat2+0x634/0xc40 [ 28.775358][ T335] ? __cfi_do_renameat2+0x10/0x10 [ 28.780618][ T335] ? strncpy_from_user+0x14d/0x270 [ 28.786715][ T335] ? __kasan_check_write+0x18/0x20 [ 28.793044][ T335] ? __kasan_check_write+0x18/0x20 [ 28.798618][ T335] __x64_sys_renameat2+0xdc/0x100 [ 28.803917][ T335] x64_sys_call+0x2e18/0x2ee0 [ 28.809040][ T335] do_syscall_64+0x57/0xf0 [ 28.813959][ T335] ? clear_bhb_loop+0x50/0xa0 [ 28.819000][ T335] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 28.825446][ T335] RIP: 0033:0x7f8d8839aeb9 [ 28.830072][ T335] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 28.850591][ T335] RSP: 002b:00007f8d89278028 EFLAGS: 00000246 ORIG_RAX: 000000000000013c [ 28.859139][ T335] RAX: ffffffffffffffda RBX: 00007f8d88615fa0 RCX: 00007f8d8839aeb9 [ 28.867307][ T335] RDX: 0000000000000003 RSI: 0000200000000540 RDI: 0000000000000003 [ 28.875832][ T335] RBP: 00007f8d88408c1f R08: 0000000000000000 R09: 0000000000000000 [ 28.884752][ T335] R10: 0000200000000580 R11: 0000000000000246 R12: 0000000000000000 [ 28.894143][ T335] R13: 00007f8d88616038 R14: 00007f8d88615fa0 R15: 00007ffc69abb908 [ 28.902543][ T335] [ 28.905914][ T335] ---[ end trace 0000000000000000 ]--- [ 29.132089][ T66] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 29.295799][ T351] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 29.315812][ T10] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 29.335718][ T66] usb 2-1: Using ep0 maxpacket: 8 [ 29.342245][ T66] usb 2-1: unable to get BOS descriptor or descriptor too short [ 29.350897][ T66] usb 2-1: config 7 has an invalid interface number: 113 but max is 0 [ 29.359467][ T66] usb 2-1: config 7 has no interface number 0 [ 29.366824][ T66] usb 2-1: config 7 interface 113 has no altsetting 0 [ 29.374368][ T66] usb 2-1: language id specifier not provided by device, defaulting to English [ 29.387219][ T66] usb 2-1: New USB device found, idVendor=17dc, idProduct=0202, bcdDevice=e6.c2 [ 29.396879][ T66] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.405338][ T66] usb 2-1: Product: ᝃꔚﺜ돁阧韟ᇥ追쾆⦂ [ 29.412284][ T66] usb 2-1: SerialNumber: syz [ 29.447686][ T351] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 29.459160][ T351] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 29.469794][ T10] usb 3-1: Using ep0 maxpacket: 8 [ 29.474945][ T351] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 29.488846][ T351] usb 4-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 29.498349][ T351] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 29.507315][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 29.518415][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 29.532828][ T351] usb 4-1: config 0 descriptor?? [ 29.540806][ T10] usb 3-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.01 [ 29.552060][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 29.560669][ T10] usb 3-1: Product: syz [ 29.564862][ T10] usb 3-1: Manufacturer: syz [ 29.569605][ T10] usb 3-1: SerialNumber: syz [ 29.575060][ T10] usb 3-1: config 0 descriptor?? [ 29.581154][ T10] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 29.625131][ T66] usb 2-1: Found UVC 0.00 device ᝃꔚﺜ돁阧韟ᇥ追쾆⦂ (17dc:0202) [ 29.634423][ T66] usb 2-1: No valid video chain found. [ 29.641351][ T66] usb 2-1: USB disconnect, device number 2 [ 29.783967][ T331] usb 3-1: USB disconnect, device number 2 [ 29.943761][ T351] plantronics 0003:047F:FFFF.0001: No inputs registered, leaving [ 29.953206][ T351] plantronics 0003:047F:FFFF.0001: hiddev96,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.3-1/input0 [ 30.144271][ T351] usb 4-1: USB disconnect, device number 2